New Application Registration Declaring a brk-<appid>:// or brk-multihub:// Redirect URI
This rule monitors Azure Active Directory (Microsoft Entra ID) audit logs for the addition or modification of application registrations that contain specific, potentially malicious redirect URI patterns ('brk-' or 'brk-multihub'). These patterns are associated with OAuth consent phishing or malicious application authorization where an adversary registers an app to intercept authorization codes.
Microsoft Sentinel (KQL)
